Windows Event ID 4766: An attempt to add SID History to an account failed
- Applicable version
- Windows Server 2008 R2 and later
- Last reviewed
- 2026-07-21
Quick summary
Windows Security Event ID 4766 records a failed attempt to add a SID to the SID History attribute of an Active Directory account, logging the Subject who attempted the change, the Target Account to be modified, and the Source Account whose SID was to be injected.
Technical Metadata
| Event ID | 4766 |
|---|---|
| Provider | Microsoft-Windows-Security-Auditing |
| Channel | Security |
| Level | Information |
| Audit keyword | Audit Failure |
| MITRE ATT&CK | TA0004 Privilege Escalation / T1134.005 Access Token Manipulation: SID-History Injection |
| Key fields to watch | Target Account\Account Name / Security ID, Source Account\Account Name, Subject\Account Name / Security ID |
Trigger Scenarios
SID History additions are a specialized migration operation requiring domain-level privilege. A failed attempt is generated when an attacker lacks the necessary rights, when SID filtering blocks the attempted cross-forest SID, or when a deliberate probe tests whether the operation would succeed before attempting it with different credentials.
Key Fields
Target Account\Account Name / Security ID
The account that was the intended recipient of the injected SID. Targeting a highly-privileged account (Domain Admins member, Krbtgt, or an admin service account) signals an attempt to grant that account the access rights of the Source Account's SID.
Source Account\Account Name
The account whose SID was to be injected into Target Account's SID History. If Source Account Name belongs to a domain admin, Enterprise Admin, or a privileged service account in another domain, the attacker intended to grant Target Account those cross-domain rights silently.
Subject\Account Name / Security ID
The identity that attempted the modification. This event fires because the attempt failed, so Subject may be a low-privilege account probing the operation; cross-reference with any 4765 (success) records nearby to check whether a subsequent attempt with elevated credentials succeeded.
Threat Hunting Queries
SecurityEvent
| where EventID == 4766
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc- Data source
- Microsoft Sentinel SecurityEvent table
- Assumptions
- The Windows Security Events connector populates SecurityEvent. Apply the event-specific field and correlation guidance on this page after retrieving the base events.
index=wineventlog source="WinEventLog:Security" EventCode=4766
| table _time, host, user, EventCode, Message- Data source
- Splunk Windows Security event data
- Assumptions
- Index, source, and field aliases vary by Splunk deployment and Windows add-on version. Map provider fields from the raw event before adding event-specific filtering or aggregation.
dataset = microsoft_windows_raw
| filter edr_event_id = 4766- Data source
- Cortex XDR microsoft_windows_raw
- Assumptions
- The Windows Security channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
title: Windows Security Event ID 4766
status: experimental
logsource:
product: windows
service: security
detection:
selection:
EventID: 4766
condition: selection
falsepositives:
- Legitimate administrative or system activity
level: informational- Data source
- Sigma Windows Security log source
- Assumptions
- This rule retrieves the event and is not a standalone malicious-behavior detection. Add the field conditions and correlations documented on this page in the destination SIEM.
MITRE ATT&CK Mapping
- T1134.005Access Token Manipulation: SID-History Injection
Detection Notes
T1134.005 SID-History Injection triage should compare SourceUserName and TargetUserName because Event 4766 has no Status or failure-code field. Use a local correlation window=15 minutes to identify a cross-domain or privileged SID migration failure followed by Event 4765 for the same target; tune that analyst-defined window to directory replication latency, and do not manufacture a numeric result code.
Common False Positives
- Active Directory migration tools (Quest Migration Manager, ADMT) legitimately write SID History during planned forest migrations and will generate 4766 during configuration testing if privileges are not yet in place.
- Accidental permission misconfigurations during migration projects can cause expected failures from authorized tools.
Related Events
Sample Log
Subject:
Security ID: CORP\lowpriv
Account Name: lowpriv
Account Domain: CORP
Logon ID: 0x91A2F0
Target Account:
Security ID: CORP\svc-ops
Account Name: svc-ops
Account Domain: CORP
Source Account:
Account Name: Enterprise Admins
Additional Information:
Privileges: -Frequently Asked Questions
What does Windows Event ID 4766 mean?
Event ID 4766 records a failed attempt to add SID History to an account and identifies the actor, target account, and source account.
Does 4766 contain a status code?
No. The documented event fields do not include a failure code, so analysts should not invent one or infer a reason from the event ID.
How should 4766 be investigated?
Validate the migration workflow, compare source and target domains, and correlate with any later 4765 success for the same target account.
Sources
- 4766: Microsoft Windows security auditing event reference
Microsoft · vendor
- Access Token Manipulation: SID-History Injection (T1134.005)
MITRE ATT&CK · attack
- XDR Collector datasets
Palo Alto Networks · vendor
- Sigma Rules Specification
SigmaHQ · detection rule